Achieving certificate pinning security in reduced trust networks

A method, implemented at a computer system that includes at least one processor, for achieving certificate pinning security when serving data through a reduced trust network, the method comprising:

• establishing a secured first communications channel with a remote client computer system, including offering a first digital certificate to the remote client computer system for securing the first communications channel, the first digital certificate being certified by a certificate that is pinned at the client computer system;
• sending, over the first communications channel, an identity of a second digital certificate that is used by the computer system to protect integrity and authenticity of content sent by the computer system over a second communications channel;
• establishing a second communications channel with an untrusted second remote computer system;
• receiving a request over the second communications channel, the request originating from the remote client computer system, the request including a request Uniform Resource Identifier (URI);
• and
• based on receiving the request,
• generating a payload, a timestamp, and a URI portion comprising at least a subset of the request URI;
• using the second digital certificate, generating a signature over the payload, the timestamp, and the URI portion;
• and
• sending a response over the second communications channel towards the remote client computer system, the response comprising the payload, the timestamp, the URI portion, and the signature.

A computer system for achieving certificate pinning security in reduced trust networks, the computer system comprising:

• a client computer that includes one or more first processors and a first computer-readable medium having stored thereon first computer-executable instructions that are executable by the one or more first processors to cause the client computer to:
• establish a secured first communications channel with a trusted server computer, including establishing the first communications channel only upon verifying that a first digital certificate offered by the server computer for securing the first communications channel is certified by a pinned certificate;
• receive, over the first communications channel, an identity of a second digital certificate that is to be used to verify integrity and authenticity of content received over a second communications channel;
• establish the second communications channel with an untrusted remote computer system;
• send a request over the second communications channel, the request including a request Uniform Resource Identifier (URI);
• based on sending the request, receive a response from the remote computer system over the second communications channel, the response comprising a payload, a timestamp, a URI portion, and a signature over the payload, the timestamp, the URI portion;
• verify integrity and authenticity of the response including:
• verifying that the timestamp is valid;
• verifying that the URI portion corresponds to the request URI;
• and
• using the second digital certificate and the signature, verifying that the response is authentic;
• and
• based on verifying the integrity and the authenticity of the response, process the payload;
• and
• the server computer, which includes one or more second processors and a second computer-readable medium having stored thereon second computer-executable instructions that are executable by the one or more second processors to cause the server computer to:
• establish the secured first communications channel with the client computer, including offering the first digital certificate to the client computer for securing the first communications channel;
• send, over the first communications channel, the identity of the second digital certificate;
• establish a third communications channel with the remote computer system;
• receive the request over the third communications channel;
• and
• based on receiving the request,
• generate the payload, the timestamp, and the URI portion, which comprises at least a subset of the request URI;
• using the second digital certificate, generate the signature over the payload, the timestamp, and the URI portion;
• and
• send the response over the third communications channel towards the client computer, the response comprising the payload, the timestamp, the URI portion, and the signature.